Hi!
I've committed to trunk and 6.2 following backport from upstream, which ought
to fix tsan on aarch64, after bootstrapping/regtesting it on aarch64 and
verifying it no longer references any GLIBC_PRIVATE symbols.
2016-08-12 Jakub Jelinek <ja...@redhat.com>
PR sanitizer/71042
* tsan/tsan_platform_linux.cc: Cherry-pick upstream r278292.
* tsan/tsan_rtl_aarch64.S: Likewise.
--- libsanitizer/tsan/tsan_platform_linux.cc.jj 2016-01-15 10:56:52.049822705
+0100
+++ libsanitizer/tsan/tsan_platform_linux.cc 2016-08-11 12:40:43.382323344
+0200
@@ -60,6 +60,10 @@ extern "C" void *__libc_stack_end;
void *__libc_stack_end = 0;
#endif
+#if SANITIZER_LINUX && defined(__aarch64__)
+void InitializeGuardPtr() __attribute__((visibility("hidden")));
+#endif
+
namespace __tsan {
static uptr g_data_start;
@@ -261,6 +265,10 @@ void InitializePlatform() {
SetAddressSpaceUnlimited();
reexec = true;
}
+#if SANITIZER_LINUX && defined(__aarch64__)
+ // Initialize the guard pointer used in {sig}{set,long}jump.
+ InitializeGuardPtr();
+#endif
if (reexec)
ReExec();
}
--- libsanitizer/tsan/tsan_rtl_aarch64.S.jj 2016-01-15 10:56:52.044822774
+0100
+++ libsanitizer/tsan/tsan_rtl_aarch64.S 2016-08-11 12:42:09.505230486
+0200
@@ -1,4 +1,62 @@
#include "sanitizer_common/sanitizer_asm.h"
+
+.section .bss
+.type __tsan_pointer_chk_guard, %object
+.size __tsan_pointer_chk_guard, 8
+__tsan_pointer_chk_guard:
+.zero 8
+
+.section .text
+
+// GLIBC mangles the function pointers in jmp_buf (used in {set,long}*jmp
+// functions) by XORing them with a random guard pointer. For AArch64 it is a
+// global variable rather than a TCB one (as for x86_64/powerpc) and althought
+// its value is exported by the loader, it lies within a private GLIBC
+// namespace (meaning it should be only used by GLIBC itself and the ABI is
+// not stable). So InitializeGuardPtr obtains the pointer guard value by
+// issuing a setjmp and checking the resulting pointers values against the
+// original ones.
+.hidden _Z18InitializeGuardPtrv
+.global _Z18InitializeGuardPtrv
+.type _Z18InitializeGuardPtrv, @function
+_Z18InitializeGuardPtrv:
+ CFI_STARTPROC
+ // Allocates a jmp_buf for the setjmp call.
+ stp x29, x30, [sp, -336]!
+ CFI_DEF_CFA_OFFSET (336)
+ CFI_OFFSET (29, -336)
+ CFI_OFFSET (30, -328)
+ add x29, sp, 0
+ CFI_DEF_CFA_REGISTER (29)
+ add x0, x29, 24
+
+ // Call libc setjmp that mangle the stack pointer value
+ adrp x1, :got:_ZN14__interception12real__setjmpE
+ ldr x1, [x1, #:got_lo12:_ZN14__interception12real__setjmpE]
+ ldr x1, [x1]
+ blr x1
+
+ // glibc setjmp mangles both the frame pointer (FP, pc+4 on blr) and the
+ // stack pointer (SP). FP will be placed on ((uintptr*)jmp_buf)[11] and
+ // SP at ((uintptr*)jmp_buf)[13].
+ // The mangle operation is just 'value' xor 'pointer guard value' and
+ // if we know the original value (SP) and the expected one, we can derive
+ // the guard pointer value.
+ mov x0, sp
+
+ // Loads the mangled SP pointer.
+ ldr x1, [x29, 128]
+ eor x0, x0, x1
+ adrp x2, __tsan_pointer_chk_guard
+ str x0, [x2, #:lo12:__tsan_pointer_chk_guard]
+ ldp x29, x30, [sp], 336
+ CFI_RESTORE (30)
+ CFI_RESTORE (19)
+ CFI_DEF_CFA (31, 0)
+ ret
+ CFI_ENDPROC
+.size _Z18InitializeGuardPtrv, .-_Z18InitializeGuardPtrv
+
.hidden __tsan_setjmp
.comm _ZN14__interception11real_setjmpE,8,8
.type setjmp, @function
@@ -21,10 +79,9 @@ setjmp:
mov x19, x0
// SP pointer mangling (see glibc setjmp)
- adrp x2, :got:__pointer_chk_guard
- ldr x2, [x2, #:got_lo12:__pointer_chk_guard]
+ adrp x2, __tsan_pointer_chk_guard
+ ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
- ldr x2, [x2]
eor x1, x2, x0
// call tsan interceptor
@@ -69,10 +126,9 @@ _setjmp:
mov x19, x0
// SP pointer mangling (see glibc setjmp)
- adrp x2, :got:__pointer_chk_guard
- ldr x2, [x2, #:got_lo12:__pointer_chk_guard]
+ adrp x2, __tsan_pointer_chk_guard
+ ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
- ldr x2, [x2]
eor x1, x2, x0
// call tsan interceptor
@@ -119,10 +175,9 @@ sigsetjmp:
mov x19, x0
// SP pointer mangling (see glibc setjmp)
- adrp x2, :got:__pointer_chk_guard
- ldr x2, [x2, #:got_lo12:__pointer_chk_guard]
+ adrp x2, __tsan_pointer_chk_guard
+ ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
- ldr x2, [x2]
eor x1, x2, x0
// call tsan interceptor
@@ -171,10 +226,9 @@ __sigsetjmp:
mov x19, x0
// SP pointer mangling (see glibc setjmp)
- adrp x2, :got:__pointer_chk_guard
- ldr x2, [x2, #:got_lo12:__pointer_chk_guard]
+ adrp x2, __tsan_pointer_chk_guard
+ ldr x2, [x2, #:lo12:__tsan_pointer_chk_guard]
add x0, x29, 32
- ldr x2, [x2]
eor x1, x2, x0
// call tsan interceptor
Jakub
